Air-gapped secure messaging for closed networks
SANKET (Sanket.Chat) by Tosh Defence is a secure messaging platform that runs fully air-gapped: messaging, file exchange, voice and video calls and priority broadcast operate on a closed network with no path to the internet. Everything it needs at run time sits inside the enclave, and everything it needs from outside arrives on controlled media as signed, verifiable packages.
An air-gapped installation does more than reduce risk. It removes whole categories of attack path, because foreign cloud providers, external identity systems, public APIs and remote licensing are no longer involved at all.
What air-gapped means for SANKET
A true air-gapped installation runs with no runtime access to public DNS, cloud APIs, public identity providers, public push services, external certificate authorities, content delivery networks, analytics, internet time or public package repositories. SANKET is engineered for exactly that environment.
The database, object storage, key management, media server, push relay and certificate authority all run inside the enclave. Calls use the installation's own media server with an explicitly configured address, and never a public STUN service.
Every external dependency replaced
Each service a conventional platform fetches from the internet has an in-enclave equivalent in SANKET.
- Customer CA instead of a public certificate authority
- In-enclave storage and key management
- Self-hosted Android push
- Signed licence verified locally
- Offline release packages with SBOMs
- Internal SIEM over TLS syslog
Updates on controlled media
Each release is a single offline package containing a signed manifest, image archives and a software bill of materials. The installation verifies every hash and the signature before anything is loaded, refuses an expired manifest and refuses any release older than the one it has recorded, all without an online check. The upgrade snapshots the current state and rolls back automatically on failure.
Control retained
What remains is entirely inside the customer's control: servers, keys, identities, network, storage, audit records, updates, certificates, backups, administrators, policies and monitoring. No vendor or third party can observe, alter or interrupt the service.
Technical proof
Read the detail in the SANKET whitepaper
Every statement on this page is set out in full in the public SANKET Technical Security and Architecture Whitepaper, free to read without registration.
Can a secure messaging app work on an air-gapped network?
Yes. SANKET by Tosh Defence runs fully air-gapped, with an internal certificate authority, self-hosted Android push, offline licences and signed offline release packages. No SANKET component connects outside the enclave.
How are air-gapped SANKET installations updated?
With signed offline packages brought in on controlled media. The installation verifies the signature and every hash, refuses expired or older releases, installs on the customer's approval and rolls back automatically on failure.
How does licensing work without internet access?
The licence is a signed file verified locally. Renewals are signed offline bundles bound to the installation with an increasing counter.
Do voice and video calls work air-gapped?
Yes. Calls run through the installation's own media server inside the enclave, with AES-256-GCM frame encryption end to end and AES-256-GCM SRTP. No public STUN or relay service is used.
Which certificate authority does an air-gapped installation use?
The customer's own internal certificate authority issues the edge certificate and every device's client certificate.
Is on-premise the same as air-gapped?
No. On-premise means the customer's own servers, which may still be reachable from the internet. Air-gapped means the installation and its clients have no path to the internet at all. SANKET supports both, with the same security design.
Plan an air-gapped SANKET installation
Tosh Defence supports air-gapped deployments end to end: enclave design, internal PKI, controlled media procedures and offline releases.